Dynamic allocation of ports at firewall

Abstract

A system, apparatus, and method for dynamically allocating ports in a firewall is presented herein. During establishment of a data transfer session, such as a voice over IP call, the firewall receives signals which establish the data transfer session. The foregoing signals indicate the identity of the terminals as well as the port numbers used by the terminals. The firewall records the foregoing information. During the data transfer session, data packets for a terminal in the network of the firewall are examined for addresses and port numbers of the sender and destination. Wherein the foregoing information matches the information recorded during establishment of the data transfer session, the data packets are permitted to reach the terminal. Additionally, at the termination of the data transfer session, the record of the data transfer session is deleted, or otherwise indicated as invalid, and additional data packets received for the terminal are prevented from reaching the terminal, notwithstanding inclusion of the previously stored port numbers.

What is claimed is:  
     
         1 . A method for securing a communication session over a packet data network, said method comprising: 
 receiving a signal including a port number associated with a first terminal;    receiving data packets from a second terminal for transmission to the first terminal; and    transmitting the data packets to the first terminal, wherein the data packets identify the port number associated with the first terminal.    
     
     
         2 . The method of  claim 1 , wherein receiving the signal including a port associated with the first mobile station further comprises: 
 receiving communication setup signals including the port number associated with the first terminal.    
     
     
         3 . The method of  claim 2 , wherein receiving the call setup signals further comprises: 
 receiving a Session Initiation Protocol Invite signal.    
     
     
         4 . The method of  claim 1 , further comprising: 
 determining the port number identified by the data packets.    
     
     
         5 . The method of  claim 4 , wherein determining the port number identified by the data packets further comprises: 
 examining a layer of a protocol stack associated with the data packets.    
     
     
         6 . The method of  claim 1 , further comprising: 
 discarding the data packets, wherein the data packets do not identify the port associated with the first terminal.    
     
     
         7 . The method of  claim 1 , further comprising: 
 receiving a termination signal for the communication session;    receiving data packets identifying the port number associated with the first terminal after receiving the termination signal; and    discarding data packets received after receiving the termination signal.    
     
     
         8 . The method of  claim 1 , wherein the data packets comprise digitized voice signals.  
     
     
         9 . The method of  claim 1 , wherein the first terminal comprises a mobile station.  
     
     
         10 . A firewall for securing a data session, said wireless content switch comprising: 
 a plurality of input/output ports for: 
 receiving signals including port numbers associated with a first plurality of terminals;  
 receiving data packets from a second plurality of terminals for transmission to the first plurality of terminals; and  
 transmitting the data packets to the first plurality of terminals, wherein the data packets identify the port numbers associated with the first plurality of terminals;  
   a memory for storing a plurality of records, each of said records associated with a particular one of the first plurality of terminals, wherein each record comprises: 
 a first terminal identifier for identifying the particular one of the first plurality of terminals associated with the record; and  
 a first port number identifier for identifying the port associated with the terminal associated with the record.  
   
     
     
         11 . The firewall of  claim 9 , further comprising: 
 a processor for executing a plurality of instructions; and    wherein the memory stores the plurality of executable instructions, said plurality of executable instructions comprising: 
 comparing the port numbers identified in the data packets for the first plurality of terminals with the port numbers identified by the first port number identifiers of records associated with the first plurality of terminals.  
   
     
     
         12 . The firewall of  claim 11 , wherein the instructions for comparing further comprise instructions for examining a layer of a protocol stack.  
     
     
         13 . A computer readable medium for storing a plurality of executable instructions, said plurality of instructions comprising: 
 storing a port number associated with a first terminal, responsive to receiving a first signal for establishing a data transfer session between the first terminal and a second terminal;    comparing a port number identified in data packets for the first terminal, responsive to receiving the data packets; and    transmitting the data packets to the first terminal, wherein the data packets identify the stored port number.    
     
     
         14 . The computer readable medium of  claim 13 , wherein the plurality of instructions further comprise: 
 storing an address associated with a second terminal, responsive to receiving a second signal for establishing the data transfer session.    
     
     
         15 . The computer readable medium of  claim 14 , wherein the plurality of instructions further comprise: 
 comparing an address identified in the data packets with the address associated with the second terminal.    
     
     
         16 . The computer readable medium of  claim 13 , wherein the first terminal comprises a mobile station.